This document provides a sample configuration on how you can use Forced
Authorization Codes (FAC) in conjunction with route patterns to restrict the
access to long distance calls for certain groups of users.

The information in this document is based on Cisco CallManager 3.3 and
later.

The information in this document was created from the devices in a
specific lab environment. All of the devices used in this document started with
a cleared (default) configuration. If your network is live, make sure that you
understand the potential impact of any command.

FAC and Client Matter Codes (CMC) allow you to manage call access and
accounting. CMC assists with call accounting and billing for billable clients,
while FACs regulate the types of calls that certain users can place. The FAC
feature forces the user to enter a valid authorization code before the call
connects. The FAC process is defined here:

A user dials a number that goes to a FAC-enabled route
pattern.

Cisco CallManager tells the phone to play a special
tone.

The user enters the authorization code. The system then either waits
for the FAC Timer (T302/ or interdigit timer) to expire (default 15 seconds) or
for the user to press the "#" key.

Note: Since the FAC timer affects T302 timer, bear in mind that if you
adjust this timer to permit more time for FAC input, it extends the time for
normal calls as well.

If the code is correct, the call is extended to the exiting gateway
and Cisco CallManager generates a Call Detail Record (CDR) flagged with the FAC
number.

This document illustrates how a company can restrict call routing for a
certain group of users using the FAC. For illustration purposes, consider an
organization with these two types of IP phone users:

Employees

Managers

This is the requirement:

The Employee IP phones should be granted access to long distance
calls only if the caller enters a FAC with the adequate access level.

The organization managers should be able to make long distance calls
from their IP phones without the need to enter a code.

In the upper, right corner of the window, click Add a New
Forced Authorization Code.

Configure these parameters in the FAC Configuration window and
click Insert.

Authorization Code Name—Enter a unique name that
is no more than 50 characters. This name ties the authorization code to a
specific user or group of users.

Authorization Code—Enter a unique authorization
code that is no more than 16 digits. In our example, this code is configured as
12345. The user enters this code when the user places a call
through a FAC-enabled route pattern.

Authorization Level—Enter a three-digit
authorization level that exists in the range of 0 to 255; the default equals 0.
The level that you assign to the authorization code determines whether the user
can route calls through FAC-enabled route patterns. In order to successfully
route a call, the user authorization level must equal or be greater than the
authorization level that is specified for the route pattern for the call.

Create two different Calling Search Spaces (CSSs) named
Employees and Manager.

Include the partition LongDistanceEmployees in the
Employees CSS and include the partition LongDistanceManager in
the the Manager CSS. Refer to
Calling
Search Space Configuration for more information on how to configure a
CSS.

You need to create two separate long distance route patterns, one
that uses the partition LongDistanceEmployees and another that
uses the partition LongDistanceManager. Configure the route
pattern that uses the LongDistanceEmployees partition to use FAC. Complete
these steps:

In the Route Pattern Configuration window, enter the long
distance route pattern and select the LongDistanceEmployees
partition for this route pattern.

Also select the correct Gateway or Route List along with any
other desired configuration. Check Require Forced Authorization
Code and enter the Authorization Level. The number that you specify in
this field determines the minimum authorization level that is needed to
successfully route a call through this route pattern. Click
Insert.

Click Add a New Route Pattern in order to add
the long distance route pattern that uses the LongDistanceManager
partition.

In the Route Pattern Configuration window, enter the same long
distance route pattern (as in step 3b) and select the
LongDistanceManager partition for this route pattern. Ensure
that the correct Gateway or Route List is selected for this configuration.
Also, this route pattern should not be
configured to use FAC.

Under the IP Phone Configuration window, include the Employee IP
Phone Directory Number to the LongDistanceEmployees partition and to the
Employees CSS. Also, include the Manager IP Phone Directory Number to the
LongDistanceManager partition and to the Manager CSS.

Note: The CSS used by the Employee IP phones must
not include the LongDistanceManager
partition, and the CSS used by the manager's IP phone must
not include the LongDistanceEmployees
partition.

Complete these steps in order to verify if your configurations work
properly:

From Employee Extension 1000, call the long distance number
4085551234.

The system should play a tone that prompts for the authorization
code. Once the authorization code is entered, the call is connected.

Note: In order to immediately route the call after the user enters the
code, the users can press # on the phone. Otherwise the call
occurs after the interdigit timer expires, which equals 15 seconds by default.

From the Manager's Extension 1001, call the long distance number
4085551234.

The call should be connected without prompting for any
authorization code.